Руководство Пользователя для Cisco Cisco Content Security Management Appliance M160
10-15
Cisco IronPort AsyncOS 8.0 for Security Management User Guide
Chapter 10 Integrating with LDAP
Note
Use the Test Queries button in the External Authentication Queries section of the page (or the
ldaptest
command) to verify that your queries return the expected results. For related information, see
.
Step 4
Set up external authentication to use the LDAP server. Enable the appliance to use the LDAP server
for user authentication and assign user roles to the groups in the LDAP directory. For more information,
see
for user authentication and assign user roles to the groups in the LDAP directory. For more information,
see
and the “Adding Users” in
the Cisco IronPort AsyncOS for Email Security Advanced User Guide.
User Accounts Query for Authenticating Administrative Users
To authenticate external users, AsyncOS uses a query to search for the user record in the LDAP directory
and the attribute that contains the user’s full name. Depending on the server type you select, AsyncOS
enters a default query and a default attribute. You can choose to have your appliance deny users with
expired accounts if you have attributes defined in RFC 2307 in your LDAP user records
(shadowLastChange, shadowMax, and shadowExpire). The base DN is required for the domain level
where user records reside.
and the attribute that contains the user’s full name. Depending on the server type you select, AsyncOS
enters a default query and a default attribute. You can choose to have your appliance deny users with
expired accounts if you have attributes defined in RFC 2307 in your LDAP user records
(shadowLastChange, shadowMax, and shadowExpire). The base DN is required for the domain level
where user records reside.
shows the default query string and full user name attribute that AsyncOS uses when it
searches for a user account on an Active Directory server.
Table 10-5
Default Query String for Active Directory Server
shows the default query string and full user name attribute that AsyncOS uses when it
searches for a user account on an OpenLDAP server.
Table 10-6
Default Query String for Open LDAP Server
Group Membership Queries for Authenticating Administrative Users
You can associate LDAP groups with user roles for accessing the appliance.
Server Type
Active Directory
Base DN
[blank] (You need to use a specific base DN to find the user
records.)
records.)
Query String
(&(objectClass=user)(sAMAccountName={u}))
Attribute containing the user’s full name
displayName
Server Type
OpenLDAP
Base DN
[blank] (You need to use a specific base DN to find the user
records.)
records.)
Query String
(&(objectClass=posixAccount)(uid={u}))
Attribute containing the user’s full name
gecos